1

We currently use a number of linux routers, and currently a number of the team tend to jump into servers and change the routing rules when needed, and the auditing is becoming incredibly tedious.

For all other server configs we store in a git repository, and are migrating to using puppet. I haven't been able to figure out how to manage the iproute2 configuration however, as all changes are done live.

This was a similar question for cisco routers: Managing and auditing existing Cisco firewall access control and routing rules I'm wondering if something like this can be done in linux iproute2?

2 Answers 2

2

Rather than doing changes live you can create scripts which remove all current routing tables and create new fresh tables as per requirement. This script can also be added to system start-up. Backing of this script using some version control system should solve the problem.

1
  • Thanks for the comment, I was planning on doing something like this originally, but I was wondering if there was some already built package that wraps around it, like ferm for iptables rules. If not, definitely the best solution, thanks :) Nov 12, 2010 at 22:41
0

While you could use the iptables-{save,restore} syntax, it won't diff well.

You need some language to generate the rules.

I am happy with shorewall, but since you are used to the iptables command, ferm would be more suited to your use case. ferm is syntactic sugar that adds nesting to iptables rules.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .